When a computer system is managed, for example, as shown in Patent Literature 1, a cause event (event) is detected from a plurality of faults or signs of the faults, which are detected in the system. More specifically, in Patent Literature 1, management software is used to detect, as an event, an excess of performance value relative to a threshold in an apparatus under management, and accumulates the event in an event DB.
Further, the management software has an analysis engine for analyzing a causal relationship between a plurality of fault events generated in the apparatus under management. The analysis engine accesses a configuration DB having inventory information on the apparatus under management, to recognize components in the apparatus which are connected to I/O channel paths, and recognizes, as one group referred to as “topology”, the components which can affect the performance of a logical volume on the host. When an event is generated, the analysis engine applies an analysis rule, consisting of a predetermined condition sentence and analysis result, to the each topology, so as to construct an expanded rule. The expanded rule includes a cause event, which is a cause of performance degradation in the other apparatus, and a group of related events caused by the cause event. Specifically, an event described as a cause of a fault in the “THEN” portion of the rule is the cause event, and events other than the cause event, which are described in the “IF” portion of the rule, are the related events.